Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2023, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe
Resource
win10v2004-20230703-en
General
-
Target
afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe
-
Size
390KB
-
MD5
ede275f393f13d3c932487cd3f506741
-
SHA1
5c8cf11f5de0cd91c547e01339001732736cfcd4
-
SHA256
afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad
-
SHA512
a18941ada01cf8b15fe4420070277806683bc96651cf50372623f8018a4142a3e1a3aa8f4e9458b726bc04534be3b8ad1812f52e7cafccf79b3224bcb98cec4d
-
SSDEEP
12288:MMrCy90km1BTmAQEYXRcHnl9iQqzMHIz:Gynm15JgXmHWtz4Iz
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral2/files/0x0008000000023232-145.dat healer behavioral2/files/0x0008000000023232-146.dat healer behavioral2/memory/5032-147-0x0000000000010000-0x000000000001A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k3979720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k3979720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k3979720.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k3979720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k3979720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k3979720.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation l2505295.exe Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 4648 y1209862.exe 5032 k3979720.exe 3564 l2505295.exe 4264 danke.exe 4756 n4899829.exe 2272 danke.exe 3964 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 1848 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k3979720.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y1209862.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1209862.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5032 k3979720.exe 5032 k3979720.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5032 k3979720.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3564 l2505295.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4648 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 84 PID 2056 wrote to memory of 4648 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 84 PID 2056 wrote to memory of 4648 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 84 PID 4648 wrote to memory of 5032 4648 y1209862.exe 86 PID 4648 wrote to memory of 5032 4648 y1209862.exe 86 PID 4648 wrote to memory of 3564 4648 y1209862.exe 96 PID 4648 wrote to memory of 3564 4648 y1209862.exe 96 PID 4648 wrote to memory of 3564 4648 y1209862.exe 96 PID 3564 wrote to memory of 4264 3564 l2505295.exe 97 PID 3564 wrote to memory of 4264 3564 l2505295.exe 97 PID 3564 wrote to memory of 4264 3564 l2505295.exe 97 PID 2056 wrote to memory of 4756 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 98 PID 2056 wrote to memory of 4756 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 98 PID 2056 wrote to memory of 4756 2056 afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe 98 PID 4264 wrote to memory of 2444 4264 danke.exe 99 PID 4264 wrote to memory of 2444 4264 danke.exe 99 PID 4264 wrote to memory of 2444 4264 danke.exe 99 PID 4264 wrote to memory of 2052 4264 danke.exe 101 PID 4264 wrote to memory of 2052 4264 danke.exe 101 PID 4264 wrote to memory of 2052 4264 danke.exe 101 PID 2052 wrote to memory of 60 2052 cmd.exe 103 PID 2052 wrote to memory of 60 2052 cmd.exe 103 PID 2052 wrote to memory of 60 2052 cmd.exe 103 PID 2052 wrote to memory of 3128 2052 cmd.exe 104 PID 2052 wrote to memory of 3128 2052 cmd.exe 104 PID 2052 wrote to memory of 3128 2052 cmd.exe 104 PID 2052 wrote to memory of 4252 2052 cmd.exe 105 PID 2052 wrote to memory of 4252 2052 cmd.exe 105 PID 2052 wrote to memory of 4252 2052 cmd.exe 105 PID 2052 wrote to memory of 4212 2052 cmd.exe 106 PID 2052 wrote to memory of 4212 2052 cmd.exe 106 PID 2052 wrote to memory of 4212 2052 cmd.exe 106 PID 2052 wrote to memory of 1108 2052 cmd.exe 107 PID 2052 wrote to memory of 1108 2052 cmd.exe 107 PID 2052 wrote to memory of 1108 2052 cmd.exe 107 PID 2052 wrote to memory of 3460 2052 cmd.exe 108 PID 2052 wrote to memory of 3460 2052 cmd.exe 108 PID 2052 wrote to memory of 3460 2052 cmd.exe 108 PID 4264 wrote to memory of 1848 4264 danke.exe 116 PID 4264 wrote to memory of 1848 4264 danke.exe 116 PID 4264 wrote to memory of 1848 4264 danke.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe"C:\Users\Admin\AppData\Local\Temp\afd69b518bbb73411167813b5d32cfac52c77a3fb50ff01ef1394b7b9be8d4ad.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1209862.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1209862.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3979720.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3979720.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2505295.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2505295.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:2444
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:60
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:3128
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4212
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:1108
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:3460
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1848
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4899829.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4899829.exe2⤵
- Executes dropped EXE
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2272
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3964
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
175KB
MD550b6515ca3506ba1a682fde7d0ec3066
SHA130a90fc98b05b3e2ac5ae872c0f270438f2c5d8c
SHA25659a1258d73ba7f9afacab4990bc697995d49f470380645528fc294b948981ce6
SHA512da3b01242185ac76467aabdf80cb6f7f763376252099f972d05d040913b444c82bcbd44ad11e4b63756ae528a25ddf9cb1f77fc289e51a13a463e153f85d0d69
-
Filesize
175KB
MD550b6515ca3506ba1a682fde7d0ec3066
SHA130a90fc98b05b3e2ac5ae872c0f270438f2c5d8c
SHA25659a1258d73ba7f9afacab4990bc697995d49f470380645528fc294b948981ce6
SHA512da3b01242185ac76467aabdf80cb6f7f763376252099f972d05d040913b444c82bcbd44ad11e4b63756ae528a25ddf9cb1f77fc289e51a13a463e153f85d0d69
-
Filesize
235KB
MD567c98b4873cb48c65758100b76a6568d
SHA10a0dcd58f642cc8a6cc89e678a0853c104c376bd
SHA25677d840a615ff8d9b2f00a329f2a9cd6857fb87cdb6e6f368f64adf92b451e2fa
SHA512702a280edf2f1e0f3c71c8d051793d58d71681500a75f1814db325fc1a1c514b07cf3d1cbf3cfc328024e8f3325d7dbe835bb75973190088ca84be60d03b45d5
-
Filesize
235KB
MD567c98b4873cb48c65758100b76a6568d
SHA10a0dcd58f642cc8a6cc89e678a0853c104c376bd
SHA25677d840a615ff8d9b2f00a329f2a9cd6857fb87cdb6e6f368f64adf92b451e2fa
SHA512702a280edf2f1e0f3c71c8d051793d58d71681500a75f1814db325fc1a1c514b07cf3d1cbf3cfc328024e8f3325d7dbe835bb75973190088ca84be60d03b45d5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59